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I. REAL PARTY IN INTEREST 

The real party in interest is Hewlett-Packard Development Company, L.P. 
(HPDC), a Texas Limited Partnership, having its principal place of business in 
Houston, Texas. HPDC is a wholly owned affiliate of Hewlett-Packard Company 
(HPC). The Merger document from Novadigm, Inc. to HPC was recorded on 
November 9, 2004, at Reel/Frame 015355/0969. The Assignment from HPC to 
HPDC was recorded on December 21 , 2005, at Reel/Frame 016929/0378. 
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II. RELATED APPEALS AND INTERFERENCES 

Appellants are unaware of any related appeals or interferences. 
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III. STATUS OF THE CLAIMS 

Originally filed claims: 1 -40. 
Claim cancellations: None 
Added claims: None 
Presently pending claims: 1-40. 
Presently appealed claims: 1-40. 
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IV. STATUS OF THE AMENDMENTS 

No claims were amended after the final Office action dated October 9, 

2008. 
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V. SUMMARY OF THE CLAIMED SUBJECT MATTER 

This section provides a concise explanation of the subject matter defined 
in each of the independent claims, referring to the specification by page and line 
number or to the drawings by reference characters as required by 37 C.F.R. 
§ 41 .37(c)(1)(v). Each element of the claims is identified with a corresponding 
reference to the specification or drawings where applicable. The specification 
references are made to the application as filed by Appellants. Note that the 
citation to passages in the specification or drawings for each claim element 
does not imply that the limitations from the specification and drawings should be 
read into the corresponding claim element. Also note that these specific 
references are not exclusive; there may be additional support for the subject 
matter elsewhere in the specification and drawings. 

The invention of claim 1 is directed to a method 1 for updating and 
maintaining current operating information on a processor-based target device. 
The method comprises the steps of discovering 2 current operating information 
associated with the target device and comparing 3 the current operating information 
associated with the target device with updated operating information retrievable 
from a database. The method further comprises identifying 4 at least one patch 
applicable to the discovered current operating information associated with the 
target device. Further, the target device determines 5 if the at least one identified 
patch has been applied on the target device and, if necessary, applies 6 the at least 
one identified patch on the target device. The method also comprises entering an 
updated patch status of the target device in the database. 7 



1 Fig. 2, method 26. Disclosure p. 8 line 1 of para. [0033]. 

2 Fig. 2, step 28. Disclosure p. 8 line 2 of para. [0033]. 

3 Fig. 2, step 30. Disclosure p. 9 line 1 . 

4 Fig. 2, step 32. Disclosure p. 9 line 4. 

5 Fig. 2, step 34. Disclosure p. 9 line 5. 

6 Fig. 2, step 36. Disclosure p. 9 line 6. 

7 Fig. 2, step 38. Disclosure p. 9 line 7. 
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The invention of claim 10 is directed to a method for updating and 
maintaining current operating information on a processor-based target device. 
The method comprises the steps of discovering 9 current operating information 
associated with the target device and transferring 10 the current operating 
information associated with the target device to a second device. The method 
further comprises comparing 11 the current operating information associated with 
the target device with updated operating information retrievable from a database 
by the second device, identifying 12 at least one patch applicable to the current 
operating information associated with the target device, and forwarding 13 the at 
least one identified patch from the second device to the target device. The target 
device determines 14 if the at least one identified patch has been applied on the 
target device and, if necessary, applies 15 the at least one identified patch on the 
target device. The method also comprises generating 16 an updated patch status 
on the target device, sending 17 the updated patch status to the second device, 
and using 18 the second device to enter the updated patch status of the target 
device in the database. 



Fig. 3A, method 40. Disclosure p. 10 line 1 of para. [0042] 
' Fig. 3A, step 42. Disclosure p. 10 line 3 of para. [0042]. 

10 Fig. 3A, step 44. Disclosure p. 10 line 4 of para. [0042]. 

11 Fig. 3A, step 46. Disclosure p. 10 line 5 of para. [0042]. 

12 Fig. 3A, step 48. Disclosure p. 10 line 7 of para. [0042]. 

13 Fig. 3A, step 50. Disclosure p. 10 line 8 of para. [0042]. 

14 Fig. 3A, step 52. Disclosure p. 10 line 9 of para. [0042]. 

15 Fig. 3B, step 54. Disclosure p. 10 line 1 1 of para. [0042]. 

16 Fig. 3B, step 56. Disclosure p. 10 line 12 of para. [0042]. 

17 Fig. 1 , system 10. Disclosure p. 6 line 2 of para. [0023]. 

18 Fig. 3B, step 60. Disclosure p. 10 line 13 of para. [0042]. 



263739.02/2162.95400 



Page 8 of 29 



HP PDNO 200406530-2 



Appl. No. 10/826,481 

Appeal Brief dated January 21, 2009 

Reply to final Office action of October 9, 2008 



The invention of claim 17 is directed to a system 19 for updating and 
maintaining current operating information on a processor-based target device. 20 
The system comprises means for discovering 21 current operating information 
associated with the target device, means for transferring 22 the current operating 
information associated with the target device to a second device, 23 means for 
comparing 24 the current operating information associated with the target device 
with updated operating information retrievable from a database by the second 
device, and means for identifying 25 at least one patch applicable to the current 
operating information associated with the target device. The system also 
comprises means for forwarding 26 the at least one patch from the second device 
to the target device. The target device comprises means for determining 27 if the 
at least one patch has been applied on the target device and, if necessary, 
applying 28 the at least one patch on the target device. The system further 
comprises means for generating 29 an updated patch status on the target device, 
means for sending 30 the updated patch status to the second device, and means 



Fig. 3B, step 60. Disclosure p. 10 line 13 of para. [0042]. 

20 Fig. 1 , target devices 12, 14, 16. Disclosure p. 6 line 3 of para. [0023]. 

21 Fig. 1, target devices 12-16. Fig. 3A, step 42. Disclosure p. 10 line 3 of para. [0042]. 

22 Fig. 1, target devices 12-16. Fig. 3A, step 44. Disclosure p. 10 line 4 of para. [0042]. 

23 Fig. 1, servers 20-24. 

24 Fig. 1, servers 20-24. Fig. 3A, step 46. Disclosure p. 7 line 3 of para. [0029] and p. 10 line 5 of 
para. [0042]. 

25 Fig. 1, servers 20-24. Fig. 3A, step 48. Disclosure p. 10 line 7 of para. [0042]. 

26 Fig. 1, servers 20-24. Fig. 3A, step 50. Disclosure p. 7 line 4 of para. [0029] and p. 10 line 8 of 
para. [0042]. 

27 Fig. 1, target devices 12-16. Fig. 3A, step 52. Disclosure p. 8 lines 1-9 of para. [0030] and p. 10 
line 9 of para. [0042]. 

28 Fig. 1, target devices 12-16. Fig. 3B, step 54. Disclosure p. 8 lines 1-9 of para. [0030] and p. 10 
line 11 of para. [0042]. 

29 Fig. 1, target devices 12-16. Fig. 3B, step 56. Disclosure p. 8 lines 1-9 of para. [0030] and p. 10 
line 12 of para. [0042]. 

30 Fig. 1, target devices 12-16. Fig. 3B, step 58. Disclosure p. 8 lines 1-9 of para. [0030] and p. 10 
line 13 of para. [0042]. 
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for using 31 the second device to enter the updated patch status of the target 
device in the database. 

The invention of claim 18 is directed to a system 32 for updating and 
maintaining current operating information on a processor-based target device. 
The system comprises at least one target device 33 configured to receive a patch 34 
and a second device 35 configured to perform a database look-up to identify 36 at 
least one patch applicable to the at least one target device. The second device is 
capable of sending to the at least one target device a list of the at least one patch 
applicable to the at least one target device and receiving from the at least one 
target device an updated message regarding the patch status of the at least one 
target device. 37 Further, the at least one target device determines 38 which patch 
to apply to such target device from the list. 

The invention of claim 23 is directed to a method 39 for updating and 
maintaining current operating information on a processor-based target device. 
The method comprises discovering 40 current operating information associated 
with a target device and comparing 41 the current operating information against a 
desired state of information, for the target device to determine, based on policy 
data associated with the target device, whether at least one patch needs to be 
applied to the target device. The method further comprises transferring 42 the 
desired state of information to the target device and a target agent on the target 

31 Fig. 3B, step 60. Disclosure p. 7 line 12 of para. [0028] and p. 10 line 13 of para. [0042]. 

32 Fig. 3B, step 60. Disclosure p. 10 line 13 of para. [0042]. 

33 Fig. 1 , target devices 12, 14, 16. Disclosure p. 6 line 3 of para. [0023]. 

34 Disclosure p. 2 line of para. [0029]. 

35 Fig. 1, servers 20-24. 

36 Fig. 3A, step 46. Disclosure p. 10 line 5 of para. [0042]. 

37 Fig. 3A, step 50. Disclosure p. 10 line 8 of para. [0042]. 

38 Fig. 2, step 34. Disclosure p. 9 line 5. 

39 Fig. 4, method 62. Disclosure p. 1 1 line 1 of para. [0047]. 

40 Fig. 4, step 64. Disclosure p. 1 1 line 2 of para. [0047]. 

41 Fig. 4, step 66. Disclosure p. 1 1 line 3 of para. [0047]. 

42 Fig. 4, step 68. Disclosure p. 1 1 line 6 of para. [0047]. 
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device compares the desired state of information to the current operating 
information in order to identify if at least one patch should be applied to the target 
device. Further, the method comprises sending 44 a patch list from the target 
agent to a second device requesting at least one patch that should be applied to 
the target device, forwarding 45 the at least one patch from the second device to 
the target device, and applying 46 the at least one patch to the target device. 

The invention of claim 30 is directed to a data processing system 47 for 
updating and maintaining current operating information on a processor-based 
target device. The data processing system comprises of a component for 
discovering 48 current operating information associated with the target device, 
comparing 49 the current operating information associated with the target device 
with updated operating information retrievable from a database, and identifying 50 
at least one patch applicable to the current operating information associated with 
the target device. The target device determines 51 if the at least one patch has 
been applied on the target device and, if necessary, applies 52 the at least one 
patch on the target device. The system's component also enters an updated 
patch status of the target device in the database. 53 



Fig. 4, step 72. Disclosure p. 11 line 7 of para. [0047]. 

44 Fig. 4, step 74. Disclosure p. 1 1 line 9 of para. [0047]. 

45 Fig. 4, step 76. Disclosure p. 1 1 line 1 1 of para. [0047]. 

46 Fig. 4, step 78. Disclosure p. 1 1 line 12 of para. [0047]. 

47 Fig. 3B, step 60. Disclosure p. 10 line 13 of para. [0042]. 

48 Fig. 2, step 28. Disclosure p. 8 line 2 of para. [0033]. 

49 Fig. 2, step 30. Disclosure p. 9 line 1. 

50 Fig. 2, step 32. Disclosure p. 9 line 4. 

51 Fig. 2, step 34. Disclosure p. 9 line 5. 

52 Fig. 2, step 36. Disclosure p. 9 line 6. 

53 Fig. 2, step 38. Disclosure p. 9 line 7. 
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The invention of claim 33 is directed to a computer readable medium 
having computer executable instructions for performing a method. The method 
comprises discovering 55 current operating information associated with the target 
device, comparing 56 the current operating information associated with the target 
device with updated operating information retrievable from a database, 
identifying 57 at least one patch applicable to the current operating information 
associated with the target device, the target device determining 58 if the at least 
one patch has been applied on the target device and, if necessary, applying 59 the 
at least one patch on the target device, and entering 60 an updated patch status of 
the target device in the database. 

The invention of claim 35 is directed to a method 61 for managing patches 
for software. The method comprises automatically acquiring 62 a plurality of 
patches from a plurality of vendors for a plurality of software products, 
automatically discovering 63 current operating information associated with a 
plurality of target devices, automatically completing 64 a vulnerability assessment 
for the acquired plurality of patches using the discovered current operating 
information associated with the plurality of target devices, automatically 
completing 65 an impact analysis for applying the acquired plurality of patches to 
the discovered current operating information for the plurality of target devices, 



Disclosure p. 7 line 1 of para. [0027]. 

Fig. 2, step 28. Disclosure p. 8 line 2 of para. [0033]. 

Fig. 2, step 30. Disclosure p. 9 line 1. 

Fig. 2, step 32. Disclosure p. 9 line 4. 

Fig. 2, step 34. Disclosure p. 9 line 5. 

Fig. 2, step 36. Disclosure p. 9 line 6. 

Fig. 2, step 38. Disclosure p. 9 line 7. 

Fig. 5, method 80. Disclosure p. 12 line 1 of para. [0052]. 

Fig. 5, step 82. Disclosure p. 12 line 2 of para. [0052]. 

Fig. 5, step 84. Disclosure p. 12 line 3 of para. [0052]. 

Fig. 5, step 86. Disclosure p. 12 line 4 of para. [0052]. 

Fig. 5, step 88. Disclosure p. 13 line 1. 
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automatically deploying the plurality of patches to the plurality of target devices 
based on policy-based information, wherein the policy-based information includes 
in-part, information from the vulnerability assessment and the impact analysis, 
and automatically installing 67 the deployed plurality of patches on the plurality of 
target devices. The step of automatically completing the impact analysis includes 
each target device determining which patch to apply to such target device. 68 



bb Fig. 5, step 90. Disclosure p. 13 line 3. 

67 Fig. 5, step 92. Disclosure p. 13 line 6. 

68 Disclosure p. 13 lines 1-6 of para. [0054]. 
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VI. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Whether claims 1-5 and 7-40 are anticipated by Smith (U.S. Pat. 
No. 6,477,703). 

Whether claim 6 is unpatentable over Smith in view of Applicant Admitted 
Prior Art (AAPA). 



263739.02/2162.95400 



Page 1 4 of 29 



HP PDNO 200406530-2 



Appl. No. 10/826,481 

Appeal Brief dated January 21, 2009 

Reply to final Office action of October 9, 2008 

VII. ARGUMENT 

A. Anticipation rejection of claims 1-5 and 7-40 

In Smith, a tool, remote from the computer system on which a patch is to 
be installed, performs the activity specified in Smith. For instance, the remote 
tool determines which patch is to be loaded on the target computer system. See 
e.g., col. 2, lines 6-36; col. 3, lines 5-20. In Smith, the computer system to which 
the patch is to be applied does not make the determination as to which patch is to 
be applied. 

Claim 1 requires "the target device determining if the at least one 
identified patch has been applied on the target device and, if necessary, applying 
the at least one identified patch on the target device." Claim 1 thus requires that 
the claimed "target device" is the entity that identifies if a recommended patch has 
been applied on the target device and, if not, applying the patch. In Smith, only 
the remote tool, not the target computer system, determines which patches to 

apply- 
In the Final Office Action (page 6), the Examiner responded that Smith 
teaches that that a piece of software is "run on the computer" being analyzed. 
Col. 2 lines 6-7. Smith does teach that a script is run on the computer to create a 
file of the operating system, software applications, and patches that are installed 
on the computer. A script that interrogates the computer to identify its software 
components is substantially different from the claim limitation at issue which is 
"the target device determining if the at least one identified patch has been applied 
on the target device and, if necessary, applying the at least one identified patch 
on the target device." Smith's locally run script does not determine if a patch 
applicable to the computer to possibly be applied to the computer has actually 
been applied to the computer. Smith's script also does not apply the identified 
patch if necessary. Instead, in Smith, the remote tool determines which patches 
to apply and the remote tool does not run on the computer being analyzed. See 
col. 3 lines 5-8. 



263739.02/2162.95400 



Page 1 5 of 29 



HP PDNO 200406530-2 



Appl. No. 10/826,481 

Appeal Brief dated January 21, 2009 

Reply to final Office action of October 9, 2008 

The Examiner also noted Smith's use of the word "alternatively" at col. 3 
line 5. The Examiner alleged that the word alternatively means that "the preferred 
option is not the remote machine." Final Office Action page 6. However, 
Appellants respectfully submit that the Examiner has taken the word 
"alternatively" out of context. The paragraph containing "alternatively" begins at 
col. 2 line 66 and starts with an explanation that a user fills out a datasheet or is 
interviewed about the computer's configuration. The paragraph continues by 
providing an "alternative" whereby the computer runs the script noted above and 
then a remote computer determines whether any patches are applicable and 
have been applied to the computer. Thus, the alternative option is an alternative 
to a user talking to a technician over the phone, not to the computer having the 
software to perform the actions locally that are required by Appellants' claimed 
invention. 

For at least these reasons, Appellants respectfully submit that the 
Examiner erred in rejecting claim 1 and dependent claims 2-5 and 7-9 over Smith. 
The remaining independent claims, and their dependent claims, have the same or 
similar limitations to that discussed above regarding claim 1. Accordingly, for 
much the same reason as provided above, the Examiner erred in rejecting those 
claims as well. 

B. Obviousness rejection of claim 6 

Claim 6 depends from claim 1 and thus inherits the limitations of claim 1. 
Claim 1 is allowable over Smith as explained above. Even if the Examiner's 
allegation about applicants' allegedly admitted prior art, such admitted art still 
does not satisfy the deficiencies of Smith noted above. Thus, claim 6 is not 
rendered obvious by Smith in view of the alleged admitted prior art. 

C. Conclusion 

For the reasons stated above, Appellants respectfully submit that the 
Examiner erred in rejecting all pending claims. It is believed that no extensions 
of time or fees are required, beyond those that may otherwise be provided for in 
documents accompanying this paper. However, in the event that additional 
extensions of time are necessary to allow consideration of this paper, such 
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extensions are hereby petitioned under 37 C.F.R. § 1.136(a), and any fees 
required (including fees for net addition of claims) are hereby authorized to be 
charged to Hewlett-Packard Development Company's Deposit Account No. 08- 
2025. 

Respectfully submitted, 
/Jonathan M. Harris/ 



Jonathan M. Harris 
PTO Reg. No. 44,144 
CONLEY ROSE, P.C. 
(713) 238-8000 (Phone) 
(713) 238-8008 (Fax) 
ATTORNEY FOR APPELLANTS 

HEWLETT-PACKARD COMPANY 

Intellectual Property Administration 

Legal Dept., M/S 35 

P.O. Box 272400 

Fort Collins, CO 80527-2400 
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VIM. CLAIMS APPENDIX 

1. (Previously presented) A method for updating and maintaining current 
operating information on a processor-based target device, the method comprising 
the steps of: 

discovering current operating information associated with the target 
device; 

comparing the current operating information associated with the target 
device with updated operating information retrievable from a database; 

identifying at least one patch applicable to the discovered current 
operating information associated with the target device; 

the target device determining if the at least one identified patch has been 
applied on the target device and, if necessary, applying the at least one identified 
patch on the target device; and 

entering an updated patch status of the target device in the database. 

2. (Original) The method of claim 1, wherein the current operating 
information of the target device includes at least one of a group comprised of: 

(a) an identity and version level of at least one software application 
program currently residing on the target device; 

(b) an identity and version level of at least one operating system 
residing on the target device; 

(c) an identity and version level of at least one hardware device 
residing on the target device; and 

(d) an identity and version level of at least one firmware program 
residing on the target device. 

3. (Original) The method of claim 1 , further comprising the steps of: 
querying the database to determine a patch status of the target device; 

and 

identifying gaps in patch coverage for the target device. 
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4. (Original) The method of claim 1, wherein the target device is in 
communication with a server. 

5. (Original) The method of claim 1, wherein the discovering step includes a 
plurality of target devices. 

6. (Original) The method of claim 5, wherein the plurality of target devices 
include a plurality of mobile devices. 

7. (Original) The method of claim 1 further comprising a computer readable 
medium having stored therein instructions for causing a processor to execute the 
steps of the method. 

8. (Original) The method of claim 1 wherein the at least one identified patch 
includes two components comprising a state file for importing into the database 
and a manifest file used by a target agent on the target device that provides 
policy information and security information for the at least one identified patch. 

9. (Original) The method of claim 8 wherein the state file comprises patch 
information, detailed information about patch components and patch target 
information from a patch authority and wherein the manifest file includes patch 
target information from a patch authority, prerequisite and superceded path 
information, a plurality of indicators used to determine if a patch is properly 
installed and information on how to apply a patch. 

10. (Previously presented) A method for updating and maintaining current 
operating information on a processor-based target device, the method comprising 
the steps of: 

discovering current operating information associated with the target 
device; 
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transferring the current operating information associated with the target 
device to a second device; 

comparing the current operating information associated with the target 
device with updated operating information retrievable from a database by the 
second device; 

identifying at least one patch applicable to the current operating 
information associated with the target device; 

forwarding the at least one identified patch from the second device to the 
target device; 

the target device determining if the at least one identified patch has been 
applied on the target device and, if necessary, applying the at least one identified 
patch on the target device; 

generating an updated patch status on the target device; 

sending the updated patch status to the second device; and 

using the second device to enter the updated patch status of the target 
device in the database. 

1 1 . (Original) The method of claim 10 further comprising a computer readable 
medium having stored therein instructions for causing a processor to execute the 
steps of the method. 

12. (Original) The method of claim 10, wherein the second device is a server. 

13. (Original) The method of claim 10 wherein the current operating 
information of the target device includes at least one of the group comprised of: 

(a) an identity and version level of at least one software application 
program currently residing on the target device; 

(b) an identity and version level of at least one operating system 
residing on the target device; 

(c) an identity and version level of at least one hardware device 
residing on the target device; and 
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(d) an identity and version level of at least one firmware program 
residing on the target device. 

14. (Original) The method of claim 10, further comprising the steps of: 
querying the database to determine a patch status of the target device; 

and 

identifying gaps in patch coverage for the target device. 

15. (Original) The method of claim 10, wherein the discovering step includes 
multiple target devices. 

16. (Original) The method of claim 10, wherein the determining step is 
performed by a target agent residing on the target device. 

17. (Previously presented) A system for updating and maintaining current 
operating information on a processor-based target device, the system comprised 
of: 

means for discovering current operating information associated with the 
target device; 

means for transferring the current operating information associated with 
the target device to a second device; 

means for comparing the current operating information associated with the 
target device with updated operating information retrievable from a database by 
the second device; 

means for identifying at least one patch applicable to the current operating 
information associated with the target device; 

means for forwarding the at least one patch from the second device to the 
target device; 

the target device comprising means for determining if the at least one 
patch has been applied on the target device and, if necessary, applying the at 
least one patch on the target device; 
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means for generating an updated patch status on the target device; 
means for sending the updated patch status to the second device; and 
means for using the second device to enter the updated patch status of the 
target device in the database. 

18. (Previously presented) A system for updating and maintaining current 
operating information on a processor-based target device, the system comprised 
of: 

at least one target device configured to receive a patch; and 
a second device configured to perform a database look-up to identify at 
least one patch applicable to the at least one target device, the second device 
capable of sending to the at least one target device a list of the at least one patch 
applicable to the at least one target device and receiving from the at least one 
target device an updated message regarding the patch status of the at least one 
target device; 

wherein the at least one target device determines which patch to apply to 
such target device from said list. 

19. (Original) The system of claim 18, wherein the second device is a server. 

20. (Original) The system of claim 18, further comprised of: 

a target agent residing in the at least one target device, the target agent 
capable of: 

receiving the list of the at least one patch applicable to the at least one 
target device; 

determining whether the at least one patch lias been applied to the at least 
one target device; 

generating a patch status for the at least one target device; and 
sending the patch status to the second device. 



263739.02/2162.95400 



Page 22 of 29 



HP PDNO 200406530-2 



Appl. No. 10/826,481 

Appeal Brief dated January 21, 2009 

Reply to final Office action of October 9, 2008 

21. (Original) The system of claim 19, further comprising of an administrator 
capable of querying the database to determine a patch status of the at least one 
target device. 

22. (Original) The system of clam 21 , wherein the administrator can query the 
database when the target device is not in communication with the second device. 

23. (Previously presented) A method for updating and maintaining current 
operating information on a processor-based target device, the method comprised 
of: 

discovering current operating information associated with a target device; 

comparing the current operating information against a desired state of 
information, for the target device to determine, based on policy data associated 
with the target device, whether at least one patch needs to be applied to the 
target device; 

transferring the desired state of information to the target device; 

having a target agent on the target device compare the desired state of 
information to the current operating information in order to identify if at least one 
patch should be applied to the target device; 

sending a patch list from the target agent to a second device requesting at 
least one patch that should be applied to the target device; 

forwarding the at least one patch from the second device to the target 
device; and 

applying the at least one patch to the target device. 

24. (Original) The method of claim 23, wherein the second device is a server. 

25. (Original) The method of claim 23, wherein the comparing step is 
performed using a differencing method. 
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26. (Original) The method of claim 23, wherein the at least one patch that the 
policy data indicates should be applied to the target device is sent to the target 
device without a request from the target agent. 

27. (Original) The method of claim 26, wherein the policy data includes 
qualitative information about each patch. 

28. (Original) The method of claim 27, wherein an administrator determines, 
based on the qualitative information, whether a patch should be applied on the 
target device. 

29. (Original) The method of claim 28, wherein the determination of the 
administrator is included in the policy data. 

30. (Previously presented) A data processing system for updating and 
maintaining current operating information on a processor-based target device, the 
data processing system comprised of a component for: 

discovering current operating information associated with the target 
device; 

comparing the current operating information associated with the target 
device with updated operating information retrievable from a database; 

identifying at least one patch applicable to the current operating 
information associated with the target device; 

the target device determining if the at least one patch has been applied on 
the target device and, if necessary, applying the at least one patch on the target 
device; and 

entering an updated patch status of the target device in the database. 

31. (Original) The data processing system of claim 30, wherein the target 
device is in communication with a second device. 
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32. (Original) The data processing system of claim 30, wherein the second 
device is a server. 

33. (Previously presented) A computer readable medium having computer 
executable instructions for performing a method comprising: 

discovering current operating information associated with the target 
device; 

comparing the current operating information associated with the target 
device with updated operating information retrievable from a database; 

identifying at least one patch applicable to the current operating 
information associated with the target device; 

the target device determining if the at least one patch has been applied on 
the target device and, if necessary, applying the at least one patch on the target 
device; and 

entering an updated patch status of the target device in the database. 

34. (Original) The computer readable medium of claim 33, having computer 
executable instructions for performing a method further comprising: 

transferring the current operating information associated with the target 
device to a second device; 

forwarding the at least one patch from the second device to the target 
device; 

generating an updated patch status on the target device; 
sending the updated patch status to the second device; and 
using the second device to enter the updated patch status of the target 
device in the database. 

35. (Previously presented) A method for managing patches for software, 
comprising: 

automatically acquiring a plurality of patches from a plurality of vendors for 
a plurality of software products; 
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automatically discovering current operating information associated with a 
plurality of target devices; 

automatically completing a vulnerability assessment for the acquired 
plurality of patches using the discovered current operating information associated 
with the plurality of target devices; 

automatically completing an impact analysis for applying the acquired 
plurality of patches to the discovered current operating information for the plurality 
of target devices; 

automatically deploying the plurality of patches to the plurality of target 
devices based on policy-based information, wherein the policy-based information 
includes in-part, information from the vulnerability assessment and the impact 
analysis; and 

automatically installing the deployed plurality of patches on the plurality of 
target devices; 

wherein the step of automatically completing the impact analysis includes 
each target device determining which patch to apply to such target device. 

36. (Original) The method claim 35 further comprising a computer readable 
medium having stored therein instructions for causing a processor to execute the 
steps of the method. 

37. (Original) The method of claim 35 wherein the step of automatically 
completing a vulnerability analysis includes automatically completing a patch gap 
analysis to determine where components of the operating information may be 
vulnerable to applying a patch and identifies which new patches may be required 
based on the discovered current operating information. 

38. (Original) The method of claim 35 wherein the step of automatically 
completing an impact analysis includes automatically completing a conflict 
analysis to determine what new patches may be need and how the new patches 
may conflict with old patches already applied to the target device. 
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39. (Original) The method of claim 35 further comprising automatically 
verifying application of the deployed plurality of patches on the plurality of target 
devices. 

40. (Original) The method of claim 35 further comprising automatically 
performing quality assurance operations on the plurality of target devices to 
provide a desired level of quality for application of the deployed plurality of 
patches on the plurality of target devices. 
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IX. EVIDENCE APPENDIX 

None. 
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X. RELATED PROCEEDINGS APPENDIX 

None. 
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